For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

HarshaPotharaju's avatar
HarshaPotharaju
Icon for Nimbostratus rankNimbostratus
May 16, 2019

Store JSON Web Token (JWT) as a Cookie

Store JSON Web Token (JWT) as a Cookie

Scenario: I'm using F5 as an Authorization sever and back-end server/applications to handle the resource server capabilities. Now I would like to send the JWT as a cookie if any application requests from F5 APM. Please see the iRule and VPE setup below. 

Problem: iRule event (jwt-cookie is being used as agent_id) is taking place before the JWT is getting issued, so I'm seeing null for $jwt-token in the LTM logs. Could you please help on how to set cookie before "Allow' takes place?

I couldn't attach the VPE config image with the devcentral recent changes. Flow is like below.

Start -- logon page -- ldap auth -- OAuth Authorization -- iRule event -- Allow

when ACCESS_POLICY_AGENT_EVENT {
	if { [ACCESS::policy agent_id] eq "jwt-cookie" } {
		log local0. "JWT-Cookie: Started"
 
 
		set client_id [ACCESS::session data get session.oauth.authz.client_id]
		log local0. "JWT-Cookie: Client id is - $client_id"
		
		set jwt_token [ACCESS::session data get session.oauth.authz.jwt_token]
		log local0. "JWT-Cookie: jwt token is - $jwt_token" 
		HTTP::cookie insert "f5_jwt_cookie" $jwt_token
	}
}
No RepliesBe the first to reply